Auditing console access

[Steve Grubb]

On Wednesday, September 6, 2017 9:42:53 AM EDT Maupertuis Philippe wrote:
> Hi,
> The examples found in the audit documentation mention that to work it is
> assumed that no direct root login is allowed. This very sensible and not a
> big problem except for console access.

Why is it a problem for console access?  :-)

> What would be the best way to monitor what is done through this access ?

If you need to know the commands & changes made by root, then you probably 
need to use pam_tty_audit to enable tty auditing for su and sudo.

> Would you recommend to forbid root access even in console ?

Yes. Who is root? Who was root 4 years ago? By logging in with your account 
and then changing to root, the audit system can track who root is. The only 
time I can think of where you wouldn't want this tracking is when the system 
is in single user mode. (Because auditd doesn't normally start in single user 
mode.)
 
-Steve

> !!!*************************************************************************
> ************ "Ce message et les pi?ces jointes sont confidentiels et
> r?serv?s ? l'usage exclusif de ses destinataires. Il peut ?galement ?tre
> prot?g? par le secret professionnel. Si vous recevez ce message par erreur,
> merci d'en avertir imm?diatement l'exp?diteur et de le d?truire.
> L'int?grit? du message ne pouvant ?tre assur?e sur Internet, la
> responsabilit? de Worldline ne pourra ?tre recherch?e quant au contenu de
> ce message. Bien que les meilleurs efforts soient faits pour maintenir
> cette transmission exempte de tout virus, l'exp?diteur ne donne aucune
> garantie ? cet ?gard et sa responsabilit? ne saurait ?tre recherch?e pour
> tout dommage r?sultant d'un virus transmis.
> 
> This e-mail and the documents attached are confidential and intended solely
> for the addressee; it may also be privileged. If you receive this e-mail in
> error, please notify the sender immediately and destroy it. As its
> integrity cannot be secured on the Internet, the Worldline liability cannot
> be triggered for the message content. Although the sender endeavours to
> maintain a computer virus-free network, the sender does not warrant that
> this transmission is virus-free and will not be liable for any damages
> resulting from any virus transmitted.!!!"